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DETAILED ACTION 

1 . This Office Action is in response to communication filed on 02/23/2004. 

2. Claims 1-12 are pending. Claim 1 is the base independent claim. 

Claim Rejections - 35 USC § 103 

3. Claims 1-12 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Schmitz, (US 6, 665, 269 B1) in view of Yildiz (US 7, 016, 948 B1). 

Schmitz teaches method and apparatus for filtering network traffic in 802. 1 1 
wireless LAN. 

4. Regarding claim 1, Schmitz discloses a method for detecting misbehavior in a 
contention based communication networl^ (Figure 1), this method comprising the steps 
of: recording at least some of invalid frames (See Figure 4, 404 - bad frame is 
recorded in bad frame buffer per channel) with their respective station identification 
(see Figure 5) issued by the stations accessing an Access Point (Figure 1, element 
14), recording at least some of valid frames (See Figure 4, 404 - good frame is 
recorded in bad frame buffer per channel) with their respective station identification 
(See Figure 5) issued by the stations accessing the Access Point. 

Schmitz fails to disclose determining, for each station, a scrambled ratio based 
on the number of invalid frames and the number of valid frames, detecting a 
misbehavior station based on a station, which has a substantially lower ratio than the 
other stations. 

Yildiz teaches method and apparatus for detailed protocol analysis of frames 
captured in 802.11 LAN. 
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Yildiz discloses determining, for each station, a scrambled ratio based on tlie 
number of invalid frames and the number of valid frames, detecting a misbehavior 
station based on a station, which has a substantially lower ratio than the other stations. 
(See Column 12:44-58 ~ Yildiz teaches the Expert Analysis tool is capable of 
providing such information) 

It would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify Schmitz's' to incorporate a step of determining, for each 
station, a scrambled ratio based on the number of invalid frames and the number of 
valid frames, detecting a misbehavior station based on a station, which has a 
substantially lower ratio than the other stations. The motivation to collect such type of 
statistics is to determine when to generate maintenance alarm. 

5. Regarding claim 2, the combination of Schmidt and Yildiz discloses a method 
wherein the frames are Acknowledgment frames in a TCP/IP protocol. (See Yildiz 
Figure 5 and Table IB) 

6. Regarding claim 3, the combination of Schmidt and Yildiz discloses a method, 
further comprising the steps of: - calculating an average scrambled ratio on the stations 
currently connected with the Access Point and setting a suspicious status in reference 
with a given station when the same has a scrambled ratio which is below of a 
predefined threshold value. (Yildiz shows an equivalent arrangement in Column 
13:1-14 and in Figure 29) 

7. Regarding claim 4, the combination of Schmidt and Yildiz discloses a method, 
further comprising the steps of:- eliminating the stations for which the ratio is 
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substantially higher than this first average scrambled ratio, calculating a second 
average scrambled ratio on the remaining stations, setting a suspicious status in 
reference with a given station when the same has a scrambled ratio which is below of a 
predefined threshold value. . (Yildiz shows an equivalent arrangement in Column 
13:1-20 and in Figures 29 and 30) 

8. Regarding claims 5 and 6, the combination of Schmidt and Yildiz discloses a 
method, comprising the steps of: - analyzing the frames with their respective time stamp 
and station identification, - selecting a frame corresponding to an acknowledgment of a 
first station to the Access Point, - calculating a back off time to a next frame sent by a 
second station, - comparing this back off time with a lower limit and setting a suspicious 
status relative to the second station in case that the back off time is smaller than the 
lower limit and wherein the suspicious status is a counter and each positive detection 
entails the increment of this counter, and in that, when this counter has reached a 
predefined threshold, the second station is considered as cheater. (See Yildiz 
Columns 2:5-25 and 13:1-25 and Figures 29 and 30) 

9. Regarding claims 7 and 8, the combination of Schmidt and Yildiz discloses a 
method wherein it comprises the further steps of: - selecting a frame corresponding to 
an acknowledgment of the first station, - calculating the back off time to the next frame 
of the second station, - successively storing the back off times of the second station for 
a given period, - determining the random character of the stored back off times and 
considering the second station as cheater in case that the back off times are not 
uniformly distributed in a predefined range and further comprises the step of checking 
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the presence of the maximum value of the range in the stored back off times. (See 
Yildiz Column 16:5-25 and Figure 5) 

10. Regarding claim 9, the combination of Schmidt and Yildiz discloses a method 
wherein it comprises the steps of:- calculating an average back off time over the stored 
back off times for each station, - calculating an Access Point average value of the back 
off times of the Access Point,- setting a suspicious status in reference with a given 
station when the same has an average back off value smaller than the Access Point 
average back off time value. (See Yildiz Column 13:35-50) 

1 1 . Regarding claim 10, the combination of Schmidt and Yildiz discloses a method 
wherein in case that the transmission of the second station is interleaved, the back off 
time is calculated taking into account the sum of a first waiting time following the DIPS 
time while the interleaved station starts to transmit and a second waiting time while the 
second station starts to transmit. (This is standard 802.11 back off time calculation 
method as illustrated in Yildiz Column 2: 5-15) 

12. Regarding claim 1 1 , the combination of Schmidt and Yildiz discloses a method 
wherein it comprises the further steps of: - determining the number of retransmissions 
from the Access Point to each station, - determining the average number of 
retransmissions over a predefined period of time per station, setting a suspicious status 
in reference with a given station when the same has a number of retransmission 
substantially below the average number of retransmissions. (See Yildiz Column 12:15- 
26) 
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1 3. Regarding claim 12, tlie combination of Sclimidt and Yildiz discloses a metliod, 
wherein it comprises tlie further steps - determining the actual duration of a 
transmission for a given station, - comparing this duration with the declared NAV value ' 
in the RTS or DATA frames of this station, - setting a suspicious status in reference with 
this station in case that the actual duration is smaller than the declared value. (See 
Yildiz Column 9:50-67) 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Habte Mered whose telephone number is 571 272 6046. 
The examiner can normally be reached on Monday to Friday 9:30AM to 5:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Doris H. To can be reached on 571 272 7629. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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